Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-18060: Updating _fields_ of a derived struct type yields a bad cif #13374

Merged
merged 12 commits into from
Jan 1, 2024

Conversation

websurfer5
Copy link
Contributor

@websurfer5 websurfer5 commented May 17, 2019

Use the size of the fields elements array in the parent class of a Srtructure or Union derived subclass when cloning or modifying the fields array. The old behavior of using the number of elements in the parent class can cause the array to be truncated when it is copied, especially when there are multiple layers of subclassing, which can result in segfaults or exceptions. Tests are included.

https://bugs.python.org/issue18060

the base class when computing the length of the derived class.
class of a Srtructure or Union derived subclass when cloning or
modifying the _fields_ array. The old behavior of using the number
of elements in the parent class can cause the array to be truncated
when it is copied, especially when there are multiple layers of
subclassing. Tests are included.
@serhiy-storchaka
Copy link
Member

I think there is a misunderstanding from your side. size is not the size of the ffi_type_pointer.elements array. It is the size of the structure or the union.

Now StgDictObject.length of Structure and Union is the number of all
fields, including fields of superclases.
@serhiy-storchaka serhiy-storchaka added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Dec 26, 2023
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @serhiy-storchaka for commit e294757 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Dec 26, 2023
@serhiy-storchaka serhiy-storchaka added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Dec 28, 2023
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by @serhiy-storchaka for commit cedea96 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Dec 28, 2023
@serhiy-storchaka serhiy-storchaka merged commit 5f3cc90 into python:main Jan 1, 2024
95 of 113 checks passed
@serhiy-storchaka serhiy-storchaka added the needs backport to 3.11 only security fixes label Jan 1, 2024
@serhiy-storchaka serhiy-storchaka added the needs backport to 3.12 bug and security fixes label Jan 1, 2024
@miss-islington-app
Copy link

Thanks @websurfer5 for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Thanks @websurfer5 for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Sorry, @websurfer5 and @serhiy-storchaka, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 5f3cc90a12d6df404fd6f48a0df1334902e271f2 3.11

@miss-islington-app
Copy link

Sorry, @websurfer5 and @serhiy-storchaka, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 5f3cc90a12d6df404fd6f48a0df1334902e271f2 3.12

serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Jan 1, 2024
… layers (pythonGH-13374)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jan 1, 2024

GH-113623 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 bug and security fixes label Jan 1, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Jan 1, 2024
… layers (pythonGH-13374)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jan 1, 2024

GH-113624 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Jan 1, 2024
serhiy-storchaka added a commit that referenced this pull request Jan 1, 2024
GH-13374) (GH-113624)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
serhiy-storchaka added a commit that referenced this pull request Jan 5, 2024
GH-13374) (GH-113623)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
kulikjak pushed a commit to kulikjak/cpython that referenced this pull request Jan 22, 2024
…pythonGH-13374)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
aisk pushed a commit to aisk/cpython that referenced this pull request Feb 11, 2024
…pythonGH-13374)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Glyphack pushed a commit to Glyphack/cpython that referenced this pull request Sep 2, 2024
…pythonGH-13374)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Sep 19, 2024
… layers (pythonGH-13374) (pythonGH-113624)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Sep 19, 2024
… layers (pythonGH-13374) (pythonGH-113624)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Sep 19, 2024
… layers (pythonGH-13374) (pythonGH-113624)

The length field of StgDictObject for Structure class contains now
the total number of items in ffi_type_pointer.elements (excluding
the trailing null).

The old behavior of using the number of elements in the parent class can
cause the array to be truncated when it is copied, especially when there
are multiple layers of subclassing.

(cherry picked from commit 5f3cc90)

Co-authored-by: Jeffrey Kintscher <49998481+websurfer5@users.noreply.github.com>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants